Verified that the snort file is getting generated correctly. Also configured the receiver on Splunk Enterprise on port 9997.
After starting all the services, no logs are seen on Splunk. Checked using tcpdump, and forwarder never sent any logs. How can I further troubleshoot the issue?
Is it the forwarder unable to read the file? or is something on the box which is preventing the logs from going out? I verified the connectivity and iptables on both sides.. they have required rules. Am i using the correct inputs.conf file?
OS: CentOS 6.4 on both snort and splunk enterprise.
You should edit the files under $SPLUNK_HOME/etc/system/local/ or better yet create an app directory for this. If you edit files off of default disk structure your changes will be wiped upon your next version upgrade.
With that said, is there a particular reason you're using index=_internal ? That's mostly for internal Splunk diagnostics and troubleshooting, not for an app index. I don't think using _internal will work.